VU#369611: ExLlamaV3 contains Denial of Service vulnerability via insufficient bounds checking on kernel dispatch index
CERT/CC details CVE-2026-84286, an out-of-bounds memory access in ExLlamaV3's CUDA extension causing denial-of-service crashes; fixed via merged pull request.
CERT/CC published VU#369611 for CVE-2026-84286, an out-of-bounds memory access in the exllamav3_ext CUDA extension of the ExLlamaV3 LLM inference library. A crafted input with kernel parameter K set to 0 produces a negative index into a fixed 24-entry kernel dispatch array, causing a CUDA illegal memory access and denial-of-service crashes. The vendor fixed the issue in the main repository via pull request #310, and maintainers of 49 downstream projects, including ezexl3 and MawDiscord, are advised to rebuild against the patched version. The issue was reported by Nathan Keys and impact is limited to crashes and instability, not code execution.
- Crafted input with K=0 yields negative index into fixed 24-entry kernel dispatch array
- Impact is denial of service via process crashes; no code execution reported
- 49 downstream projects tracked; ezexl3 and MawDiscord told to rebuild against patched exllamav3_ext
- CVEs
- CVE-2026-84286
- Products
- ExLlamaV3exllamav3_ext
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-84286 | Out-of-bounds CUDA kernel dispatch in ExLlamaV3 | 9.8 | — |
From the original article
1 min read at kb.cert.orgOverview An out-of-bounds (OOB) memory access vulnerability involving unchecked array indexing has been identified in the exllamav3_ext compute unified device architecture (CUDA) extension. Successful exploitation can lead to an immediate denial of service or application instability. This vulnerability is tracked as CVE-2026-84286.
kb.cert.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.